December 2003 - cypherpunks-legacy

Oppenheimer Quote Regarding Government Secrecy and Public Policy
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Rather liked this quote regarding the development of the super in the 1950s. J. Robert Oppenheimer, "Atomic Weapons and American Policy," Foreign Affairs, Vol. 31, No. 4, July 1953, p. 525. [We must have] candor on the part of the officials of the United States Government to the officials, the representatives, the people of their country. We do not operate well when the important facts, the essential conditions, which limit and determine our choices are unknown. We do not operate well when they are known, in secrecy and in fear, only to a few men. The political vitality of our country largely derives form two sources. One is the interplay, the conflict of opinion and debate, in may diverse and complex agencies, legislative and executive, which contribute to the making of policy. The other is a public opinion which is based on confidence that it knows the truth. Today public opinion cannot exist in this field. No responsible person will hazard and opinion in a field where he believes that there is somebody else who knows the true, and where he believes that he does not know it. ------------------------- Regards, I hate people when they aren't polite - Talking Heads Joseph M. Reagle Jr. http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

ABA guidelines no longer read-only
by Michael Froomkin 17 Dec '03

17 Dec '03

I am informed by the webmaster of the page holding the guidelines that the Section leadership has authorized him to make the text downloadable and that he will make it available in various formats very soon. This desirable result was, however, in no way helped by what I am also informed was juvenile and in at lest one instance threatening email sent to the parties involved. That the mail identified itself as originating from members of this list -- and in response to my message announcing the site existed -- can only have the result of devaluing any comment I and other people on this list may make. Not a pretty sight. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's hot here. And humid.

1 0

Tabling Results for Primes Considered Hard
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:29 PM 10/19/95, Dr. Frederick B. Cohen wrote: >And how secure is the hash? It it possible to create values that will >hash to each prime (or something else that does the job)? Is the hash >something we can figure a way to precompute using massively parallel >processing so that we can then provide a set of codes which will produce >the desired results? (etc.) There are a lot of primes. Parallel processors will not help much. (These are deliberately understated points, natch.) With even such "small" RSA moduli as 200 digits, made up of primes of roughly 100 digits each, the computed hashes of these numbers would fill the universe many times over. (There are estimated to be about 10^75 particles of all types in the entire universe, so each particle would be "responsible" for storing the results (?) for about 10^20 or more primes.) There may be many more flaws and points of attack in Netscape and SSl, but precomputing hashes of the primes is not one of them. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: SciAm Bye-Byes Privacy
by Duncan Frissell 17 Dec '03

17 Dec '03

>Scientific American, November, 1995 > >Rights of Privacy > >Technology has its eyes on you > >But the search for personalization in a high-tech world >may create an uncomfortable situation in the global >village. Villages are safe places but not very private >ones. Mrs. Grundy, peering from behind her lace curtains, >did stop housebreakers. but she also tried to halt many >other things of which she disapproved. There are signs >that Grundyism is returning to Britain. For those who have neglected their education: 1798 Theater --- "Speed the Plough" by English playwright Thomas Morton, 34. "Be quiet, wull ye [says farmer Ashfield]. Always ding, dinging Dame Grundy into my ears-What will Mrs. Grundy say? What will Mrs. Grundy think?" DCF

1 0

Re: 50 attacks... [NOISE]
by chip＠communities.com 17 Dec '03

17 Dec '03

Hey, I just noticed his email address: > fc(a)all.net (Dr. Frederick B. Cohen) writes: > etc. Sorta makes ya think, huh? -- ------------------------------------------------------------------------------- | Chip Morningstar | | | Electric Communities | "I'm old enough to be living in | | 280 2nd Street, Los Altos, CA 94022 | the future I was warned about." | | 415-917-5640 | -- Myron Krueger | | chip(a)communities.com | | -------------------------------------------------------------------------------

1 0

Errors in the Cyphernomicon FAQ
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:29 PM 10/19/95, Scott Brickner wrote: >Andreas Bogk writes: ... >> >>In the Cyphernomicon, section 12.6.6, Tim May writes: >> >> - Chaum went to great lengths to develop system which .... >>But as far as I got Chaums idea, Alice would not reveal Bobs identity, >>but rather her own. Am I missing a point here? > >You're right. Tim's wrong. Bob can't spend the money Alice gave him >without depositing it in the bank and getting new money issued. Each >coin has "This money was issued to Alice" as an invisible imprint which >only shows up when two coins with the same serial number are together. Well, it's surely not the only error in my Cyphernomicon FAQ. I might say I'll correct mistakes pointed out to me, except that there may never be a second edition of that Cyphernomicon--the work to make changes and then upload copies is just too staggering, and I've happily put aside plans to keep it "current" with the flood of new stuff coming over the list everyday. As I've said in earlier explanations, I wrote the thing because people were always clamoring "Where's the FAQ? How come there's no FAQ? I want to see a FAQ!" After several people volunteered to work on a FAQ, and none appeared, I stupidly volunteered. Eventually, 8 months later, my Cyphernomicon appeared. And, sure enough, there have been calls recently for a "new FAQ." Complaints that the Cyphernomicon is "too long" and that it "doesn't have anything on the Netscape hacks." Well, be my guest. But beware the problem that topics drift in and out of au courancy (probably not a valid word), that today's big focus on bugs in Netscape is perhaps not what a FAQ on Cypherpunks issues might want to emphasize. But, nobody's stopping others from writing FAQs. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Anonymity: A Modest Proposal
by Adam Shostack 17 Dec '03

17 Dec '03

Futplex wrote: | The fundamental conflict, as I see it, is this: | For security reasons, we want messages to be distributed to a very wide | audience, although those messages are only of interest to a very narrow | audience. News admins understandably are generally inclined to accept | bandwidth only in proportion to readership. For practical reasons, they don't | want to carry messages to people who aren't interested in them. It's not | easy to convince the news admins to do it anyway out of altruism. How about a local group, such as ucb.anonymous? Those news admins who wanted it could get it. Not perfect, but reduced polyticks, increased usablity. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

> :I've deleted the rest of your content-free rant. Instead of alluding to > :some "flawed algorithm", why not tell us about the hole you say you've > :found in netscape? OK, Netscape functions by DESIGN as an enhanced delivery vehicle. Is that a sufficient explanation of the hole?? or is more detail necessary (which follows): Netscape blindly trusts any and all ports on all servers. On the basis of this trust, it begins a negotiation with a server that might well have a dynamic deliverability capability. The client then examines a Content-type header, trusts the content-type to decide what application it should launch, and then launches and processes the data block it is fed, all on good faith. It even trusts the server to redirect it to any arbitrary destination which it automatically loads and then executes. Is this enough of an explanation?? Or should I paraphrase: Netscape is a gateway that permits an untrustworthy server to take complete control of a client's machine. The server can tell the client where it should go, what it should load and how often, and what applications to execute on the client machine, as though this arbitrary server were its master. Does this help to underscore the problem?? The Netscape Navigator client was DESIGNED to be controlled remotely from any machine on the Internet. This is the "flawed algorithm". W3 was meant to be hypertext ... not a gateway that permits a server to deliver customized byte bombs down a clearcut path by remote-control. If people don't know that you don't let another person (or machine) take control of your machine and run programs on it ... well, like I said in the past. > "Let me make this absolutely clear. > > It should not be up to non-US citizens like myself to safe-guard US > economic security, and protect vital national interests. It is not > my job and certainly not my responsibility to protect the international > public and Fortune 500 companies from poor security." So without giving out another "exploitation algorithm" to the Internet, without extending a helping hand to Japan to retaliate against the US for the American Japanese auto surveillance, I will simply quote from two sources which are "public record" and mentioned in the FAQ. >From the "Orange Book", one of the volumes of the Department of Defence's "Rainbow Series" more commonly known as TCSEC (Trusted Computer System Evaluation Criteria) and available from: U.S. Government Printing Office INFOSEC Awareness Office Superintendent of Documents - or - National Computer Security Centre Washington, DC 20402 9800 Savage Road Fort George G. Meade, MD 20755-6000 which stipulates that: "... it is required that ADP (Automated Data Processing) systems that "process, store, or use classified data and produce classified information will, with reasonable dependability, prevent: a. Deliberate or inadvertent access to classified material by unauthorized persons, and b. Unauthorized manipulation of the computer and its associated peripheral devices." The above quoted reference is public information. And, since Netscape is making "no-comment" I will quote Netscape's public information. > NETSCAPE CLIENT APIS (NCAPIS) 2.0 > The NCAPIs are designed to allow third-party applications to > remotely control the Netscape Navigator client. They are > platform specific, utilizing the platform's native method of > interprocess communication (IPC). These APIs are not final > and may change with the release of version 1.1 of Netscape > Navigator (they do not work with Netscape Navigator 1.0). Herein is the "flawed algorithm" which is just a fancy way of saying that it's a flawed idea. And this isn't new ... it's been there for a long time. Generally, we don't routinely trust every other computer, foreign or domestic on the Internet to manipulate us by remote control. This is as basic as the idea that we don't give out our PIN numbers with our banking cards to anyone who asks us. If someone tries to suggest differently, then they are a fool. Let's recall that Version 1.1 of Navigator was released long ago, and trusts every machine on the Internet to do just that. It trusts every other machine on the Internet to be "trustworthy". Whether that machine is foreign or domestic. We are not speaking about the new and improved -- feature added -- "beta" 2.0 software, we are speaking of the software that AT&T is using internally and is selling to its customers as we speak as a "co-branded" product. Software which AT&T security "approved" of in direct contravention of the most basic of basic security principles. Let me reiterate this. Netscape's current existing software was designed in direct contravention of the US Department of Defence's evaluation criteria for Trusted Computer Systems, the TCSEC. It also contravenes the ITSEC (Information Technology Security Evaluation Criteria) which is a document developed by the British, German, French, and Netherlands governments. (Anyone can get a free copy of ITSEC by writing to the Commission of the European Communities in Brussels.) Netscape forgot one thing about trust. If you "trust everyone" ... even if you always trust everyone, you always cut the cards. And when you're playing poker at these stakes ... well ... 'nuff said. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. Please don't shoot the messenger. C. S. U. M. O. C. L. U. N. E. P.P.S If this is confusing to anyone, please direct your comments to one or all of the following newsgroups: alt.2600 alt.security comp.security.announce comp.security.misc comp.virus

6 5

Re: airport security
by Duncan Frissell 17 Dec '03

17 Dec '03

At 05:25 AM 10/19/95 -0400, Futplex wrote: >It's bad enough that it is "illegal" (at least according to some recent ARC >flight coupons of mine) to sell or otherwise transfer your tickets to someone >else. I'd love to see them try to justify crap like that. Find a friendly travel agent. Roll the ticket stock out of the printer before your ticket is printed. Cross out and initial the offending terms. Pay for the ticket and have it printed. We call it negotiation. DCF "But my name *is* Dr. Fred C. Schwartz. I changed it just before I got these tickets from Dr. Fred C. Schwartz. I asked him to get them for me. I may change my name back to Duncan Frissell after the flight."

1 0

Re: airport security
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:16 AM 10/19/95 -0400, Bob Bruen, MIT Lab for Nuclear Science wrote: > Without actually agreeing with the FAA, the reason you can't have a name > other than your own on your ticket, as well as why you are required to > be in your assigned seat on take-off and landing is because if there is > a plane crash, they need to be able to identify an otherwise difficult > to identify body. This does have some relevance to airport security if > a plane is blown up. So, since planes were much more likely to crash in 1957 then they are now, I suppose that you *really* must have had to prove your identity to get on a plane in those days. DCF "Who wonders who's going to blow away the Gremlins eating the engines of *today's* planes since the passengers have been disarmed." Too much Outer Limits/Twilight Zone/Science Fiction Theater as a kid.

1 0